CVE-2020-13340: 
GitLab vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7, and 13.4.2. The vulnerability was specifically found in the CI Job Log functionality (GitLab Release, CVE Mitre).

The vulnerability exists in the error message handling of build dependencies within GitLab's CI/CD pipeline system. The failure_message was incorrectly marked as safe without proper sanitization, allowing for the injection of malicious scripts. This vulnerability was particularly concerning for self-managed GitLab installations where dependencies validation is enabled by default (GitLab Issue).

The stored XSS vulnerability allows attackers to perform arbitrary actions on behalf of victims at the client side. The impact is particularly severe as it could potentially be triggered even in environments with Content Security Policy (CSP) in place through specific exploitation techniques (GitLab Issue).

The vulnerability can be exploited by creating a specific CI/CD pipeline configuration with manipulated build dependencies. When users view the job details of the affected pipeline, the malicious script would execute in their browser context (GitLab Issue).

GitLab has addressed this vulnerability in versions 13.2.10, 13.3.7, and 13.4.2. Organizations are strongly recommended to upgrade to these versions or later to mitigate the risk. The fix involves proper sanitization of the failure_message in build dependencies (GitLab Release).